Actions-cool GitHub Actions re-disabled after malware return

Two popular GitHub Actions maintained under the actions-cool namespace have been disabled for a second time after briefly coming back online and again executing the Mini Shai-Hulud credential-stealing malware in CI/CD pipelines.^[1][7][13] The repositories, actions-cool/issues-helper and actions-cool/maintain-one-comment, now display a notice that access has been disabled due to a previous violation of GitHub’s terms.^[1]

In the original May 18 compromise, attackers gained write access to the issues-helper repository and retargeted every existing version tag to a single imposter commit outside the normal commit history.^[2][4][7] The malicious workflow downloaded the Bun JavaScript runtime, read memory from the GitHub Actions Runner.Worker process to harvest in-flight secrets, and exfiltrated CI/CD credentials over HTTPS to the attacker-controlled domain t.m-kosche[.]com.^[2][3][5][7] Workflows pinned to a specific commit SHA rather than a tag were spared, but any pipeline referencing these actions by version tag pulled the malicious code on its next run.^[2][7][10]

Researchers have linked this GitHub Actions activity to the broader Mini Shai-Hulud supply chain campaign that targeted AI and cloud developer tooling across npm, PyPI and RubyGems ecosystems.^[7][8][9] The same exfiltration infrastructure, including t.m-kosche[.]com, was observed in attacks on @antv npm packages and other popular projects, strengthening the assessment that a single threat actor cluster is behind both waves.^[7][13] The Cloud Security Alliance has associated Mini Shai-Hulud with CVE-2026-45321, a chained GitHub Actions exploitation path rated 9.6 under CVSS v3.1 for its ability to bypass SLSA build provenance and hijack release pipelines.^[8]

The recent reactivation of the actions-cool repositories appears to have restored access to the imposter commits, causing workflows that still depended on tag-based versions to resume executing the malicious payload until GitHub intervened again.^[1][7] GitHub previously disabled the compromised actions in May, but the brief window of renewed accessibility this month raises the risk that some organizations may have unknowingly re-triggered infected pipelines if they had not audited and removed the dependencies.^[1][13] GitHub has again disabled access to both repositories, preventing new workflows from adding the actions until the investigation concludes.^[1][13]

Security teams that previously used actions-cool/issues-helper or actions-cool/maintain-one-comment should assume any secrets touched by affected pipelines may have been compromised and perform full credential rotation for GitHub tokens, cloud keys and CI/CD service accounts.^[2][5][9] Organizations are also advised to search logs for references to the actions-cool namespace and the domain t.m-kosche[.]com, and to monitor for any unusual repository creation patterns that could indicate Mini Shai-Hulud-style exfiltration.^[5][7][9] Longer term, researchers recommend pinning GitHub Actions to audited commit SHAs, enforcing stricter review on pull_request_target workflows, and adopting hardened supply chain controls such as SLSA attestations and OIDC-based publishing with short-lived tokens.^[8][9][12]

References

1. Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
2. actions-cool/issues-helper GitHub Action Compromised: All …
3. ACTIVE SUPPLY CHAIN ATTACK 🚨 The actions-cool/ …
4. Popular GitHub Action Tags Redirected to Imposter …
5. GitHub Actions workflow compromised to steal CI/CD …
7. Compromised GitHub Actions tags exfiltrated CI/CD secrets …
8. Mini Shai-Hulud: AI Developer npm Supply Chain Worm – Lab Space
9. Mini Shai-Hulud: Cross-Ecosystem Supply Chain Attack …
10. GitHub Actions Supply Chain Attack Via Imposter Commits
12. The State of Open Source Supply Chain Attacks – StepSecurity
13. GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK